New Shuttle: Hundreds of Safety Changes Also Add Risks

By WILLIAM J. BROAD

Published: June 28, 1988

AFTER two years and more than $2 billion, the space shuttle has been completely rebuilt in a process involving hundreds of changes to key systems and support gear. Experts say they believe the winged spaceship is safer than ever and nearly ready to fly, but they note that the multitude of design changes, never before tested in flight, introduce new risks of their own.

Now standing inside the 52-story vehicle assembly building at the Kennedy Space Center in Florida, the shuttle Discovery is to be moved Sunday to the launching pad, marking a critical milestone in the nation's re-covery from the Challenger disaster in January 1986 that killed seven astronauts and grounded the nation's shuttle fleet.

In late August or early September, the revamped Discovery is scheduled to make the first shuttle flight in nearly three years, blasting into space with a five-man crew.

In a series of interviews, officials and experts of the National Aeronautics and Space Administration discussed the long repair process, its promise and problems. Many seemed emotionally torn as they spoke, clearly eager to increase safety but visibly frustrated by the numerous changes and flight delays the process has entailed.

''The period of penance has been long enough,'' said George T. Sasseen, director of shuttle engineering at the Kennedy Space Center in Florida. ''We're in this business to get into space, not to modify equipment.''

The sweeping alterations to the shuttle system, 400 by one count, 600 by another, have been made to enhance reliability, improve performance and increase safety. But paradoxically, experts say the changes also can aggravate two of the space agency's worst problems: delays in the launching schedule and risk for the astronauts during the craft's first flight.

''You introduce complexity when you try to fix things up,'' said Charles Perrow, a Yale sociologist and author of ''Normal Accidents,'' a study of high-technology risk. ''For every positive improvement in safety you also add a negative factor because of the complexity. And sometimes that will catch up with you.''

Although the most important changes were in the design of the flawed solid-fuel booster rocket, whose leak triggered the Challenger explosion, hundreds of other changes were made to the shuttle itself, its systems and support equipment on the ground.

Space agency experts emphasize that improved hardware should make Discovery's flight one of the safest ever. Yet they also acknowledge that the changes add an unmeasurable degree of risk to the mission since new hazards can be accidently added as others are eliminated. Indeed, the first post-Challenger mission is viewed as a test flight, the crew consisting entirely of space veterans ready to handle ''surprises'' during the four-day voyage.

''There's some risk on that score,'' said Richard A. Colonna, head of the orbiter projects office at the Johnson Space Center in Houston. ''But I personally think it's minor.''

Indeed, the space agency has struggled to minimize risk by extensively testing new hardware on the ground, searching as best it can for weak points before the flight. Altered equipment has been shaken, vibrated, powered up, run, taken apart, inspected and run again - everything short of the ultimate test, flying it in space. Support equipment has also been put through its paces. Moreover, the assembled spaceship, which is to sit on the launching pad for two months before thundering aloft, will be put through a host of inspections and tests.

However, experts note that the continuing process of testing also has the potential to uncover new flaws, again delaying the oft-postponed mission. Such an episode occurred last December when a nozzle part in a booster rocket unexpectedly burned off during a test firing, triggering a change in the rocket design and further delaying the launching two months.

Despite lingering threats, excitement is building throughout the space agency as the launching draws near. Last week, cheers and applause broke out among several hundred workers at the Kennedy Space Center as the 85-ton Discovery was towed to the giant assembly building, where it will be mated with its two booster rockets and its external fuel tank before moving to the launching pad.

''This is like a rebirth,'' John J. Talone Jr., director of Discovery's ground processing, said as the spaceship emerged into the sunlight for the first time in 600 days. ''We're in business again and we're going to stay in business.'' Urgent, Prudent or Optional

The extensive changes to the nation's three remaining space shuttles, Discovery, Columbia and Atlantis, arose in several ways. First, some improvements were planned or under consideration before Challenger's fiery demise. Second, the Presidential commission that investigated the Challenger disaster issued a report in June 1986 that recommended a series of major alterations. Finally, NASA proposed many other changes after its own review uncovered new areas of concern. The accumulated changes were broken into three categories: urgent ones to be done before the next flight, prudent ones no later than 1989 or 1990, and optional ones by 1991 or 1992.

So far, the cost of overhauling the shuttle and its support systems has come to about $2.4 billion, according to James H. Brier, a financial analyst at NASA headquarters in Washington. When the changes are finished, he said, the total bill should be about $3.5 billion. The figures include modifications at the Kennedy and Johnson space centers as well as the following repairs to the shuttle and its rockets:

* The 149-foot-long, solid-fuel booster rockets have been redesigned top to bottom in a process involving 145 changes to components, including the joints and seals between booster segments that failed in the Challenger launching, the internal insulation, the fuel igniter, the nozzle, and the giant bracket holding the booster in place. As a backup, external heaters have been added to keep seals from the kind of cold-weather stiffening that helped touch off the Challenger disaster.

* The shuttle's three main liquid-fuel engines have undergone about 30 hardware changes, including the strengthening of turbopump blades to prevent cracking and strengthening of main fuel valve housings and main combustion chamber outlets to block structural failure.

* The 154-foot-long external fuel tank, which holds liquid oxygen and hydrogen for the main engines, has undergone eight changes, including the strengthening of a fuel line housing, the use of a more reliable battery and the redesign of an explosive bolt used to disconnect electrical cables on the launching pad.

* The 122-foot-long spaceship has undergone about 220 changes, including rewiring, brake and steering improvements, the stiffening of the landing gear, strengthening of structures in wings and engine pods, and improvements in heat-absorbing tiles on the shuttle's surface. A pair of 17-inch fuel valves connecting the spacecraft and the external fuel tank have been overhauled to insure they stay open while engines are firing. Additions to the ship include a new hatch that can be blown off in an emergency, an escape pole so the astronauts can bail out at high altitudes, and an escape slide to help them flee the craft while on the ground. Changes on the Ground

In addition to these changes, the shuttle's support equipment at the Johnson and Kennedy space centers has undergone sweeping modifications. For instance, the astronaut walkway on the 34-story gantry next to the launching pad has been outfitted with flame deflectors and water sprinklers to aid astronauts trying to escape a burning shuttle. In addition, two escape baskets have been added to the existing five on the gantry, allowing more astronauts and workers to speed down 1,200-foot cables to safety on the ground. At the terminus is a large new bunker with steel-reinforced concrete walls in which personnel can take shelter.

The computer programs that control the shuttle's launching have been altered, with about 38,000 changes to 500,000 lines of computer code, according to Mr. Sasseen at the Kennedy Space Center. All told, he said, there have been some 160 major modifications to shuttle support gear at Kennedy.

''We agonized over each and every one of them because they didn't come for free,'' Mr. Sasseen said. For example, modifications of a huge gantry arm that pulls hydrogen fumes away from the external fuel tank cost between $4 million and $5 million, he said. During Challenger's launching, the arm failed to lock in place, threatening to bounce and hit the spacecraft as it moved skyward. The revamped arm is more secure, officials say. Too Much Caution? Perhaps the biggest change of all is attitude. Today NASA officials constantly talk of safety, conservatism and prudence. Indeed, some experts say there may be too much caution over the hardware changes.

''I personally feel some were unnecessary,'' said Mr. Colonna of the Johnson Space Center. ''But there were arguments on both sides, and the total management team felt they were worth doing. In general, all the modifications were good things to have done.''

Asked if NASA had lost its nerve, Mr. Colonna replied: ''It's not that. It's a new attitude saying we should take the extra steps to be sure that we're safe, and when people do that they start being very conservative.''

But the changes, while increasing safety when considered individually, can add a new kind of riskiness. Indeed, for this reason the credo of aerospace engineers is ''If it's not broken, don't fix it.'' For instance, a new bolt might increase the reliability of a joint, but it also might unexpectedly block the movement of a nearby piece of critical equipment. Equivalent of 100 Missions

To minimize such risks, the space agency has embarked on an extraordinary program of testing. For instance, in Building 49 at the Johnson Space Center, huge vibrators have subjected an exact replica of the shuttle's new escape pole to the kind of pounding it will get during launch and landing. It has been shaken over and over, for an equivalent of 100 missions. ''We completed the vibration tests without structural failure, satisfying requirements for safety and operational use,'' said Bill Adams, an aerospace engineer in charge of the work.

So too, the shuttle's main engines have been repeatedly run to check changes and make sure modifications have introduced no new uncertainties. Altogether, 208 test firings have taken place since the Challenger accident, nine of those being tests of Discovery's engines, according to Robert D. Paster, a vice president of the Rocketdyne Division of Rockwell International in Canoga Park, Calif.

Moreover, two additional propulsion tests must be successfully completed before Discovery is cleared for launch. On July 22, with the spaceship bolted firmly to the launch pad, its three main engines are to be fired for 20 seconds to test modifications and to give the launch team countdown practice. Four days later, a fifth and final full-scale ignition is planned for the redesigned booster rocket at the Morton Thiokol plant in Utah, where the rockets are built.

Of course, all this testing and preparation is no guarantee that the shuttle, once aloft, will have a flawless flight. There still could be unexpected problems, despite years of work, hundreds of improvements, and billions of dollars meant to enhance safety.

''The worst thing you can do to an airplane is put it in a hanger for three years and make a lot of changes,'' said John M. Lounge, one of the five astronauts training to fly Discovery. ''When you bring that airplane back, the first thing you do is a test flight to wring out every system, to find the surprises. We'll see that. To a large extent this mission is a check flight.''